The Federal Energy Regulatory Commission (FERC) hasissued areport with recommendations for the “users, owners and operators of the bulk-power system improve their compliance with mandatory Critical Infrastructure Protection (CIP) standards as well as their overall cybersecurity posture.”

The findings shared in the report were based upon the “non-public CIP audits of registered entities that found most of the cybersecurity protection process and procedures adopted by the entities met the mandatory requirements of the standards.” FERC reported that the lessons they learned from conducting “audits completed in fiscal year 2019 can help entities assess their risk and compliance with mandatory reliability standards and… can facilitate efforts to improve the security of the nation’s electric grid.”

The lessons FERC staff learned in the audits were:

1.       “Consider all generation assets, regardless of ownership, when categorizing BES Cyber Systems associated with transmission facilities.

2.       “Ensure that all employees and third-party contractors complete the required training and that the training records are properly maintained.

3.       “Verify employees’ recurring authorizations for using removable media.

4.       “Review all firewalls to ensure there are no obsolete or overly permissive firewall access control rules in use.

5.       “Limit access to employee’s PIN numbers used for accessing PSPs using a least-privilege approach.

6.       “Ensure that all ephemeral port ranges are within the Internet Assigned Numbers Authority (IANA) recommended ranges.

7.       “Clearly mark Transient Cyber Assets and Removable Media.”

FERC staff from the “Office of Electric Reliability and Office of Enforcement conducted the audits in collaboration with staff from the North American Electric Reliability Corporation and its regional entities. In addition to assessing compliance with the CIP reliability standards, the report includes recommendations regarding cybersecurity practices that are voluntary.”

The recommendations in the report include:

• “Consider all generation assets, regardless of ownership, when categorizing bulk electric system cyber systems associated with transmission facilities;
• “Ensure that all employees and third-party contractors complete the required training and that the training records are properly maintained;
• “Verify employees’ recurring authorizations for using removable media; and
• “Review all firewalls to ensure there are no obsolete or overly permissive firewall access control rules in use.”

Southwest Power Pool, Inc. (SPP) submitted revisions to its Membership Agreement, on August 2, “pursuant to section 205 of the Federal Power Act (FPA) and part 35 of the Commission’s regulations.” The revisions were submitted to “add definitions for the terms Load Serving Entity (LSE) and non-LSE.” SPP’s revisionswent into effect by operation of law on October 1. This is because the Federal Energy Regulatory Commission (FERC) did not act on the filing within the established 60-day period, which means that FERC did not reach a quorum about the proposal.

Chairman Neil Chatterjee and Commissioner Bernard L. McNamee issued a joint statement on their stance on the proposal.

Chatterjee and McNamee said that in 2013 SPP proposed revisions to the same Agreement, wanting to “require a member to post a deposit, at the time the member provides its notice of intent to withdraw, to defray any costs SPP would incur to process the member’s withdrawal from membership in SPP. At the time, SPP proposed basing the amount of the deposit on whether the member is an LSE or a non-LSE, with the former submitting a $150,000 deposit and the latter submitting a $50,000 deposit.” The proposal would adjust the deposit based on the actual costs, “with the member either receiving an invoice for any additional costs exceeding the deposit or a refund of any unexpended deposit amounts.” This proposal had been accepted.

SPP’s current proposal “asserts that the proposed definitions are just and reasonable because they address a gap in the current Membership Agreement and will provide greater clarity to all members as to which level of withdrawal deposit will apply in the event that a member submits a notice of intent to withdraw.9 SPP further asserts that the revisions are just and reasonable because they rely on Commission-accepted definitions set forth in the OATT, under which SPP members have long been operating and should be familiar.”

Both Chatterjee and McNamee say they “would have accepted SPP’s proposed revisions to its Membership Agreement… and found the proposed definitions just and reasonable and not unduly discriminatory or preferential. We would have acknowledged that the proposed definitions are consistent with the definitions for LSE in Attachments C and AE in SPP’s OATT and agreed with SPP that defining these terms in the Membership Agreement provides clarity to members as to which level of withdrawal deposit will apply in the event that a member submits a notice of intent to withdraw.”

They say that since there was no quorum in this proposal, they were not able to “fully discuss the issues that arose in this proceeding with our fellow Commissioner, whose arguments we would have thoughtfully considered.”

Commissioner Richard Glick also released a brief statement on the matter.

Glick said that he “signed an ethics pledge that precludes me from working on any matters in which Avangrid, Inc. or any of its affiliates or subsidiaries is a party until November 29, 2019.” He said that while “Avangrid has not intervened in this particular proceeding, the substantive issues presented relate directly to a contested issue in another pending proceeding, Docket No. EL19-11-000, in which Avangrid intervened.” He decided that to be cautious, he would not have participated in the proceeding.

In February, “pursuant to section 205 of the Federal Power Act (FPA),ISO New England Inc. (ISO-NE) filed the results from the thirteenth Forward Capacity Auction (FCA 13), to become effective June 28, 2019 (FCA 13 Results Filing).” Then, in response to a request from the Federal Energy Regulatory Commission (FERC) for additional information, “ISO-NE requested waiver of section 388.112(b)(2)(i) of the Commission’s regulations,2 which requires parties seeking privileged treatment for certain filings to provide intervenors who execute a protective agreement with access to that privileged material.” In September the filing went into effect through the operation of law.

If FERC “does not act on a filing made pursuant to section 205 of the FPA within the 60-day period established therein because the Commission lacks a quorum, FPA section 205(g)(1)(B) requires each Commissioner to deliver a written statement to explain their views on the change. Chairman Neil Chatterjee and Commissioner Bernard L. McNamee released a joint statement, and Commissioner Richard Glick also released a statement.

Here is the statement from Chairman Neil Chatterjee and Commissioner Bernard L. McNamee.

Chatterjee and McNamee assert that ISO-NE requested the waiver of FERC’s regulations because they wanted to look at “the information contained in the Deficiency Response because it claims that the information is ‘highly confidential, non-public, proprietary business and competitively-sensitive commercial information’ similar to information that the Commission has previously declined to disclose.” They said that “ISO-NE stated that neither the resource-specific cost data submitted by Killingly nor the IMM’s evaluation thereof should be disclosed to participants and intervenors, even under a non-disclosure agreement.”

“Killingly’s owner and developer, NTE Connecticut, LLC (NTE), objects to the disclosure of the information in the Deficiency Response and supports ISO-NE’s arguments… NTE contends that the disclosure of this commercially sensitive information to Killingly’s direct competitors would irreparably harm Killingly’s ability to compete.”

Capacity Suppliers “oppose the Waiver Request, noting, among other things, that ISO-NE provided no justification for the complete redaction of its Deficiency Response and that, because of the redaction, intervenors are denied the ability to meaningfully participate in this proceeding.”

Chatterjee and McNamee say they would have voted in favor of granting the Waiver Request. FERC “has recognized both that parties have an interest in protecting the confidentiality of their data and that they must be permitted to participate meaningfully in proceedings. To address these competing principles, the Commission weighs the interests of a party seeking confidential treatment for information against the interests of parties seeking access to that information.”

They say that in the past using non-disclosure agreements in order to access the confidential information, and this helped to maintain the balance. “But, the Commission has also recognized that it is inappropriate to disclose confidential material that can create adverse impacts to competition, even under a non-disclosure agreement. Specifically, in the FCA 8 Order and 2017 Waiver Order, the Commission ruled that release of resource-specific privileged information was inappropriate because that information would remain sensitive beyond the FCAs in question and could harm the competitiveness of FCAs going forward.”

NTE objected to FERC’s “issuance of deficiency letters in this proceeding, contending that such letters are meant to address ‘minor, technical shortcomings’ in tariff filings, like a failure to meet “threshold filing requirements,” not to investigate the merits of a protest.” NTE has argued that FERC “could only act to (1) reject the filing on the merits; (2) accept the results despite Capacity Suppliers’ protest; (3) accept the results as filed but note that Capacity Suppliers could file a complaint; or (4) accept the results but set the issues raised in the protest for hearing. Because the Commission did not take any of these actions, NTE argues that the FCA 13 Results Filing went into effect by operation of law on June 28, 2019.”

Chatterjee and McNamee say they “would have rejected NTE’s objections in regard to the issuance of the deficiency letters. The FCA 13 Results Filing was in substantial compliance with the Commission’s filing requirements because ISO-NE submitted information regarding certain FCA 13 inputs and reported detailed FCA 13 outputs resulting from ISO-NE’s application of the FCA Tariff provisions.” There were testimonies submitted by ISO-NE staff “in support of the competitiveness of FCA 13. However, consistent with the discussion in PP&L, Commission staff issued a deficiency letter to cure specific omissions identified in the rate filing… ISO-NE did not provide sufficient cost data to evaluate Killingly’s offer floor price and, therefore, the justness and reasonableness of the FCA 13 Results Filing. Therefore, we would have found that the precedent cited by NTE does not suggest that the Commission improperly issued the deficiency letters in this proceeding.”

They also found that “the FCA 13 Results Filing did not go into effect by operation of law on June 28, 2019. ISO-NE submitted the Deficiency Response on June 28, 2019 and its response to the Second Deficiency Letter on July 26, 2019. Each of these responses established a new filing date for the FCA 13 Results Filing and reset FPA section 205’s 60-day clock.”

They explained that they “would have found that Killingly was appropriately mitigated. Based on an evaluation of the data submitted in the Deficiency Response in this docket, we believe that the IMM complied with its responsibilities as outlined in the Tariff…  we would have found that through its Deficiency Response, ISO-NE demonstrated that its review was not focused solely on whether Killingly received out-of-market revenues but rather that the IMM scrutinized all aspects of Killingly’s offer to ensure they were consistent with prevailing market conditions, including all relevant cost components and revenue assumptions that support Killingly’s offer.”

As for the “the arguments by Vineyard Wind, Massachusetts Attorney General Maura Healey (Massachusetts Attorney General), Clean Energy Advocates and/or Public Citizen Inc. (Public Citizen) related to Vineyard Wind’s participation in the auction, specifically that FCA 13 resulted in unjust and unreasonable rates because the Vineyard Wind facility was not exempted from the Minimum Offer Price Rule (MOPR) as a Renewable Technology Resource.” It is because of this that Chatterjee and McNamee would have rejected these arguments.

“Vineyard Wind met the Tariff requirements to seek Renewable Technology Resource status at the time FCA 13 took place on February 4, 2019, it did not qualify by the October 2, 2018 deadline established in the Tariff. Vineyard Wind did seek a waiver of the Tariff to participate in FCA 13 as a Renewable Technology Resource on December 14, 2018, in Docket No. ER19-570-000. However, that waiver request remains pending… there has been no action on the Vineyard Wind waiver request, and on February 4, 2019, Vineyard Wind had not received a waiver to allow it to be treated as a Renewable Technology Resource. Based on these facts, we would have found that ISO-NE treated Vineyard Wind’s capacity appropriately and in accordance with the Tariff—not as a Renewable Technology Resource—when it conducted FCA 13.”

They conclude explaining that it was because of a “lack of quorum at the time of the statutory deadline for Commission action on the FCA 13 Results Filing, we were unable to fully discuss the issues that arose in this proceeding with our fellow Commissioner, whose arguments we would have thoughtfully considered. To the extent any of those discussions raised new issues for consideration, we would have carefully considered those matters and incorporated them into the decision-making process.”

Commissioner Richard Glick also issued a short statement about the issue.

Glick said that he “signed an ethics pledge that, as relevant here, precludes me from working on any matters in which Avangrid, Inc. or any of its affiliates or subsidiaries is a party until November 29, 2019. Vineyard Wind LLC filed a protest and answer in this proceeding. Vineyard Wind LLC is a joint venture between Copenhagen Infrastructure Partners and Avangrid Renewables, LLC, which is a subsidiary of Avangrid, Inc. Accordingly, I am not participating in this proceeding.”